US charges Russian ‘bulletproof’ web hosts over cyberattacks that netted $62M from cybercrime victims

U.S. prosecutors have charged three Russian nationals and two web hosts with hacking, conspiracy, and money laundering over their alleged roles in hosting cyberattacks that caused tens of millions of dollars in damages to U.S. businesses.

The three Russians, Alexander Volosovik, Kirill Zatolokin, and Yulia Pankova, who reside in St. Petersburg, are accused of owning and running two web hosts, Media Land and ML.Cloud, which allegedly provided criminals and state-backed hackers with web hosting and infrastructure support for carrying out cyberattacks.

The Russians were first charged in 2024, but the indictment was unsealed this week. The U.S. Treasury previously sanctioned Media Land and ML.Cloud for allowing ransomware gangs, including LockBit, BlackSuit, and Play, to use their infrastructure. Economic sanctions bar Americans and U.S. businesses from transacting with the Russians or their companies.

Prosecutors said that hackers used the web hosts to launch distributed denial-of-service attacks designed to knock websites and services offline, launch phishing attacks, and carry out cyberattacks on critical infrastructure in the United States.

Hackers used the companies to launch attacks on dozens of U.S. businesses across more than 20 states, netting some $62 million in proceeds from cybercrime.

According to the Justice Department, by offering their services as a “bulletproof” web host, the companies deliberately aimed to shield their customers from law enforcement demands and takedowns.

The web host suspects are unlikely to be captured, given that the hackers are located in Russia and extraditions to the U.S. are rare. Russia is known to shield its citizens from overseas extradition requests, but law enforcement have previously arrested high-value suspects when they travel to countries with diplomatic agreements with the United States.

In a statement, U.S. Assistant Attorney General A. Tysen Duva said the actions of the web hosts “put the American public at risk,” adding: “We will continue to dismantle these networks and protect our critical infrastructure from cybercriminals at home and abroad.”